Privacy

1. The short version

You can read every reference page on this site without telling us anything. We set no advertising cookies and run no third-party tracking scripts. If you buy something, Stripe handles the payment and we hold your email address. If you ask for a provider introduction, your details go to that one provider and nowhere else. We do not sell personal information, and we do not have a marketing list to add you to.

2. What we collect

When you just read the site

Ordinary web server logs: your IP address, the page requested, the time, your browser's user agent string, and the referring page. These are generated by the hosting platform for security and reliability. We do not build profiles from them.

When you use the free address check

The address you type is sent to the US Census Bureau's public geocoding service to find its coordinates, and then matched against our datasets. We do not store the address, do not associate it with you, and do not require anything else from you to run it.

When you buy a report

Your email address, the address you asked about, and the fact and amount of the payment. Your card details go directly to Stripe and never touch our systems.

When you subscribe

Your email address, the address you asked us to monitor, and, for provider placement, your company name and service area. We also store a short summary of what the record showed at the last check, so we can tell when it changes.

When you request a provider introduction

Your email address, your ZIP code, what you need, and anything you write in the notes box.

When you email us

Your message and your email address, kept as long as needed to deal with it.

3. What we deliberately do not do

These are design decisions rather than promises about intent, which means they hold even if our intentions change:

• There is no report database. A purchased report is not stored anywhere. Your link is a cryptographically signed token containing the address, and the report is regenerated from public data every time it is opened. There is no archive of who looked up what, because we chose not to build one.
• There are no accounts and no passwords. Nothing to breach, nothing to reuse elsewhere.
• There is no advertising technology. No ad network, no retargeting pixel, no social widget, no session recording, no fingerprinting.
• There is no marketing list. Buying a report does not subscribe you to anything. We have no newsletter to add you to.
• We never sell personal information, and we have never done so.

4. Why we hold each thing

• Email address: to deliver what you bought, to send monitoring alerts, and to reach you about your purchase. Not for marketing.
• Monitored address: because monitoring an address requires knowing which address.
• Record summary: to detect change. It contains counts, not personal data.
• Payment records: because tax and accounting law requires keeping them.
• Server logs: security, abuse prevention and diagnosing faults.

Where a legal basis is required, ours is performance of a contract for the purchase and delivery, and legitimate interests for security logging.

5. Who else sees it

• Stripe processes payments and stores subscription details, under its own privacy policy.
• SendGrid delivers our transactional email.
• Vercel hosts the site and generates the server logs.
• The US Census Bureau receives addresses submitted for geocoding, as a public government service.
• One provider, and only one, receives an introduction request you submit, matched to your area and your stated need.

We may also disclose information if legally required, or to protect our rights or someone's safety. If we are ever compelled to hand something over we will tell you unless the law forbids it.

If the business is sold or merged, information may transfer as part of it, subject to this policy.

6. Cookies and tracking

This site sets no advertising or analytics cookies and there is consequently no cookie banner, because there is nothing to consent to.

The hosting platform may set a strictly necessary cookie for security and load balancing. Stripe sets its own cookies on its checkout pages, which are on Stripe's domain rather than ours.

We honour Global Privacy Control and Do Not Track signals by default, in the sense that there is no cross-site tracking here to switch off.

7. How long we keep it

• Server logs: as retained by the hosting platform, typically about 30 days.
• Report purchase records: as long as tax law requires, currently seven years.
• Subscription data: while the subscription is active, then as required for accounting.
• Introduction requests: deleted from our inbox once handled.
• Free address checks: never stored at all.

8. Your rights and how to use them

Whatever jurisdiction you are in, you may ask us to tell you what we hold about you, give you a copy, correct it, or delete it. Write to hello@umwelt.com from the address you used, or tell us which address to look up.

We will respond within 30 days. There is no charge, we will not make you create an account to ask, and we will not treat you differently for asking.

9. US state privacy rights

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas and other states with comprehensive privacy laws have rights to know, access, correct, delete, and to opt out of sale, sharing, targeted advertising and profiling.

We make those rights simple to exercise because the answers are the same for everyone: we do not sell personal information, we do not share it for cross-context behavioural advertising, we do not use it for targeted advertising, and we do not profile anyone. There is accordingly nothing to opt out of, and no "Do Not Sell My Personal Information" mechanism is needed because the underlying activity does not happen.

For access, correction or deletion, use the contact route in section 8. You may use an authorised agent. If we ever deny a request we will say why and how to appeal.

10. Addresses are not people

A point worth stating plainly, because it is the heart of what this site does. Our reports describe public records about locations: cleanup sites, industrial facilities, water systems, fuel tanks. They contain no information about any individual, and we do not compile information about individuals.

Our terms prohibit using anything from this site to evaluate a person, including for tenancy, employment, credit or insurance. We are not a consumer reporting agency and our material is not a consumer report under the Fair Credit Reporting Act.

11. Security

The site is served over HTTPS with a strict content security policy. Access to paid material uses cryptographically signed, expiring links rather than passwords. Payment card data never reaches our systems. The architecture holds very little personal data in the first place, which is the most reliable security measure available.

No system is perfectly secure. If you find a vulnerability, please tell us at hello@umwelt.com and we will work with you; we will not pursue good-faith security research.

12. Children

This site is not directed at anyone under 18 and we do not knowingly collect information from children. If you believe a child has given us information, write to us and we will delete it.

13. Changes

If this policy changes materially we will update the review date at the top and, for subscribers, send an email. We will never apply a materially worse policy retroactively to data already collected.